Compliance: missing-pr-quality

[don-petry]

Compliance Finding

Category: rulesets
Severity: error
Check: missing-pr-quality

Detail

Missing pr-quality repository ruleset

Standard Reference

standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

---

This issue was automatically created by the weekly compliance audit.

[don-petry]

Weekly Compliance Audit (2026-04-06)

This finding is still open.

Detail: Missing pr-quality repository ruleset

Standard: standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

[don-petry]

Weekly Compliance Audit (2026-04-06)

This finding is still open.

Detail: Missing pr-quality repository ruleset

Standard: standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

[don-petry]

Weekly Compliance Audit (2026-04-06)

This finding is still open.

Detail: Missing pr-quality repository ruleset

Standard: standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

[claude]

Claude finished @don-petry's task in 4m 53s —— View job • claude/issue-48-20260406-0322 • Create PR ➔

---

Implementing pr-quality Ruleset Fix

• Read repo structure and understand the compliance framework
• Read standards/github-settings.md for the pr-quality ruleset specification
• Create scripts/apply-rulesets.sh to apply the standard ruleset via GitHub API
• Self-review: fixed gh api --jq --arg bug (unsupported syntax → pipe to jq directly)
• Commit and push changes

What was implemented

scripts/apply-rulesets.sh — a script that creates or replaces the pr-quality ruleset on any repo in the org via the GitHub REST API.

Ruleset configuration (per standards/github-settings.md):

Setting	Value
Target branch	Default branch (~DEFAULT_BRANCH)
Enforcement	Active
Required approving reviews	1
Dismiss stale reviews on push	Yes
Required review thread resolution	Yes
Require code owner review	Yes
Require last push approval	Yes
Allowed merge methods	Squash only
Allow force pushes	No
Allow deletions	No
Bypass actors	OrgAdmin (always), dependabot-automerge-petry (pull_request)

Usage — after merging, run with an admin token to create the ruleset:

# Apply to just this repo
GH_TOKEN=<admin-token> REPO=.github ./scripts/apply-rulesets.sh

# Dry-run to preview changes
GH_TOKEN=<admin-token> DRY_RUN=true ./scripts/apply-rulesets.sh

# Apply to all org repos at once
GH_TOKEN=<admin-token> ./scripts/apply-rulesets.sh

Note on compliance closure

The compliance audit checks the live GitHub API for the pr-quality ruleset — it won't clear until the ruleset is actually created on the repo. Merging this PR adds the tool to do that; running the script with admin credentials is the final step.

|

[don-petry]

Weekly Compliance Audit (2026-04-06)

This finding is still open.

Detail: Missing pr-quality repository ruleset

Standard: standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

[claude]

Claude finished @don-petry's task in 7m 41s —— View job • claude/issue-48-20260406-0342 • [Create PR ➔](https://github.com/petry-projects/.github/compare/main...claude/issue-48-20260406-0342?quick_pull=1&title=Issue%20%2348%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%2348%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

---

Fixing pr-quality Compliance Issue

• Gather context
• Read CLAUDE.md and repo structure
• Understand standards for pr-quality ruleset
• Create scripts/apply-rulesets.sh to apply the pr-quality ruleset
• Commit and push
• Create PR: petry-projects/.github#65
• CI passes — all checks green (Lint, ShellCheck, CodeQL, SonarCloud, Agent Security Scan, Claude Code)
• No review comments to address

What was implemented

scripts/apply-rulesets.sh creates or updates the standard pr-quality ruleset on any petry-projects repo via the GitHub REST API.

Ruleset configuration (per standards/github-settings.md):

Setting	Value
Target branch	Default branch (~DEFAULT_BRANCH)
Enforcement	Active
Required approving reviews	1
Dismiss stale reviews on push	Yes
Required review thread resolution	Yes
Require code owner review	Yes
Require last push approval	Yes
Allow force pushes	No
Allow deletions	No
Squash-only merges	Enforced via required_linear_history

Usage — after merging, apply the ruleset with an admin token:

# Apply to this repo
GH_TOKEN=<admin-token> ./scripts/apply-rulesets.sh .github

# Dry-run
DRY_RUN=true GH_TOKEN=<admin-token> ./scripts/apply-rulesets.sh .github

# Apply to all org repos
GH_TOKEN=<admin-token> ./scripts/apply-rulesets.sh --all

@don-petry — PR is ready for review and merge. The compliance finding won't close until the ruleset is actually created on the repo by running the script with an admin token after merging.
• claude/issue-48-20260406-0342